ISO 13485 certification: medical device quality guide

Overview

What ISO 13485 covers, who needs it, and how medical-device organizations prepare for certification.

What it is

ISO 13485:2016 specifies quality management requirements for organizations involved in the medical-device lifecycle and supply chain. It emphasizes regulatory requirements, risk-based processes, design and development, supplier controls, traceability, cleanliness where relevant, validation, complaint handling, vigilance, records, and corrective action.

Why it matters

Certification is often commercially important to manufacturers and suppliers and can support confidence in controlled medical-device processes. It is not product approval, market authorization, CE marking, or FDA clearance, and each jurisdiction’s medical-device law still applies.

How to obtain it or demonstrate compliance

1. Define the legal entity, sites, products, services, and processes inside the certification scope.
2. Buy or lawfully access the current standard and perform a documented gap assessment.
3. Implement objectives, responsibilities, controls, records, competence, and corrective-action processes.
4. Complete internal audits and a management review, then close identified gaps.
5. Select a competent certification body—preferably accredited for the standard and sector—and verify its status.
6. Complete the stage 1 and stage 2 audits, correct nonconformities, and maintain certification through surveillance and recertification.

What to review

1. Confirm the current edition, certification scope, sites, legal entities, exclusions, and certificate validity.
2. Map applicable laws, regulator duties, contracts, customer requirements, and sector-specific controls separately from the voluntary standard.
3. Test whether policies operate in practice and whether records support each material claim before the external audit.
4. Describe the standard, edition, scope, certification body, accreditation, and limitations accurately in procurement and marketing.

What to do next

Treat certification as an operating system, not a document project. Assign accountable owners, measure performance, investigate failures, correct root causes, and keep evidence current between audits.

Official sources and further reading

• ISO 13485:2016 — Medical device quality management — International Organization for Standardization
• Certification — ISO does not perform certification — International Organization for Standardization